CVE-2026-109854
2.5LowPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-457
Impact
Attackers can read uninitialized stack memory, causing limited information disclosure or unexpected behavior. To trigger it, they must trick a user or application into processing crafted ISO-2022 encoded text.
Root cause
m17n-lib fails to initialize stack memory before reading it during ISO-2022 text decoding.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Fix & remediation
Apply the upstream patch from commit f3b85087f90189f91c04ba1b62c5f0b879ff2b20 or update m17n-lib once your distribution issues a package. If patching must wait, avoid decoding untrusted ISO-2022 encoded input in applications using m17n-lib.
$ rpm -q m17n-lib || dpkg -l m17n-libAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.